Internet-based activities are now subject to electronic vandalism. For example, a vandal or hacker may attack a target such as an Internet web server by flooding the target with a torrential flow of disruptive messages that overload the target to the point of functional failure. Attacks of this kind are called “denial of service” attacks. During a denial of service attack, the vandal may fraudulently assume a number of different electronic identities, often by including messages in the disruptive flow that have a variety of source addresses.
More specifically, a spoofing vandal or a spoofer is an attacker who uses a source address or other marking that fraudulently identifies the vandal as a source that the target already knows or that the target will normally accept at face value. Here, a network-addressable device whose identity is used by a vandal is called both a “spoofed device” and a “network-addressable device.”
In one kind of denial-of-service attack, a spoofing vandal may send the target a large number of Internet Control Message Protocol (ICMP) messages called Packet INternet Gropers (PINGS), which are normally used to query whether a particular Internet address is accessible to the sender. Upon receiving a PING, the target sends a response message to the spoofed device rather than the vandal, as the PING bears the fraudulently used identity of the spoofed device. By flooding the target with PINGS, the vandal may divert the target's resources away from other tasks, and may also cause unproductive network congestion by triggering a flood of response messages.
In another kind of denial-of-service attack, the vandal may send the target a large number of TCP SYN messages. A TCP SYN message is normally used to initiate a TCP connection. Upon receiving a SYN message, the target sends a SYN/ACK message to the spoofed device rather than the vandal, as the SYN message bears the fraudulently used identity of the spoofed device. Further, the target reserves an internal data structure presumably to be used in supporting a connection with the spoofed device. So, by flooding the target with a large number of SYN messages, the vandal causes not only the problems mentioned above—resource diversion and network congestion—but also exhausts the target's capacity to support the data structures needed to establish other connections. Thus, the target is left unable to reliably establish connections with any device except the spoofed device.
To combat such attacks, a potential target may rely upon protective equipment that filters incoming messages. Such equipment detects the onslaught of a vandal's attack, reads the source addresses or other markings that the vandal usurps and fraudulently re-uses, and blocks all messages that seem to originate from this source.
Unfortunately, protective equipment of this kind addresses only part of the problem. The spoofed device remains unaware that its identity has been stolen, and the target is left with evidence that purports to show, albeit incorrectly, that the spoofed device—rather than the vandal—has attacked the target.
Thus there is a need for a defense against spoofing vandals, where the defense involves the spoofed device and not just the target, so that the spoofed device may become aware that its identity has been stolen, and so that the target does not conclude incorrectly that it has been attacked by the spoofed device.